What is a data subject?
Under GDPR, a data subject is the individual to whom the personal data relates.
GDPR does not require the individuals to reside in any particular jurisdiction and does not extend protections to the information of legal persons (although Member State implementations of GDPR may do so).
Dead individuals are not natural persons and therefore their information is not subject to GDPR (although the information on dead individuals may also refer to living persons, in which case it can come under the scope of data protection law).
The extent to which data protection rules may apply before birth depends on the general position of the specific legal systems about the protection of rights of the unborn in general which should be considered together with the idea that the purpose of data protection rules is to protect the individual.
As opposed to privacy law, GDPR places no relevance on the nature of the relationship between the data subject and the controller. In fact, data protection rules apply just the same whether a relationship between the data subject and the controller exists or not. In that sense, the concept of ‘breach of confidentiality’ is only relevant under GDPR to the extent that it relates to the confidentiality obligations imposed on the processor by the controller.
